Questions about sha256 and salt used

[Gax-c]

I've got some questions when browsing the source code.

1. The sha256 here is used to generate the key from secret. But sha256 itself is not a secure algorithm for key derivation. Some other algorithms like PBKDF2 will be better.

2. Why the salt and IV are the same here, they are supposed to be different to provide security.

I think these two may lead to potential vulnerabilities.